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- The MAILING DATE of this communication appears on the cover sheet with the correspondence address 
Period for Reply 



A SHORTENED STATUTORY PERIOD FOR REPLY IS SET TO EXPIRE 3 MONTH(S) FROM 
THE MAILING DATE OF THIS COMMUNICATION. 

- Extensions of time may be available under the provisions of 37 CFR 1 .136(a). In no event, however, may a reply be timely filed 
after SIX (6) MONTHS from the mailing date of this communication. 

- If the period for reply specified above is less than thirty (30) days, a reply within the statutory minimum of thirty (30) days will be considered timely. 

- If NO period for reply is specified above, the maximum statutory period will apply and will expire SIX (6) MONTHS from the mailing date of this communication. 

- Failure to reply within the set or extended period for reply will, by statute, cause the application to become ABANDONED (35 U.S.C. § 133). 
Any reply received by the Office later than three months after the mailing date of this communication, even if timely filed, may reduce any 
earned patent term adjustment. See 37 CFR 1 .704(b). 

Status 

1 )S Responsive to communication(s) filed on 15 May 2001 . 
2a)D This action is FINAL. 2b)£0 This action is non-final. 

3) D Since this application is in condition for allowance except for formal matters, prosecution as to the merits is 

closed in accordance with the practice under Ex parte Quayle, 1935 CD. 1 1 , 453 O.G. 213. 

Disposition of Claims 

4) £3 Claim(s) 1-66 is/are pending in the application. 

4a) Of the above claim(s) is/are withdrawn from consideration. 

5) D Claim(s) is/are allowed. 

6) KI Claim(s) 7-66 is/are rejected. 

7) D Claim(s) is/are objected to. 

8) D Claim(s) are subject to restriction and/or election requirement. 

Application Papers 

9) D The specification is objected to by the Examiner. 

10)^ The drawing(s) filed on 15 May 2001 is/are: a)KI accepted or b)D objected to by the Examiner. 

Applicant may not request that any objection to the drawing(s) be held in abeyance. See 37 CFR 1 .85(a). 

Replacement drawing sheet(s) including the correction is required if the drawing(s) is objected to. See 37 CFR 1.121(d). 
1 1 )□ The oath or declaration is objected to by the Examiner. Note the attached Office Action or form PTO-1 52. 

Priority under 35 U.S.C. § 119 

12)D Acknowledgment is made of a claim for foreign priority under 35 U.S.C. § 1 19(a)-(d) or (f). 
a)D All b)D Some * c)Q None of: 

1 .□ Certified copies of the priority documents have been received. 

2. Q Certified copies of the priority documents have been received in Application No. . 

3. Q Copies of the certified copies of the priority documents have been received in this National Stage 

application from the International Bureau (PCT Rule 17.2(a)). 
* See the attached detailed Office action for a list of the certified copies not received. 
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2) □ Notice of Draftsperson's Patent Drawing Review (PTO-948) Paper No(s)/Mail Date. . 

3) □ Information Disclosure Statement(s) (PTO-1449 or PTO/SB/08) 5 ) D Notice of Informal Patent Application (PTO-152) 

Paper No(s)/Mail Date . 6) □ Other: . 
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DETAILED ACTION 

1. Claims 1-66 are pending. 

Claim Objections 

2. Claims 8, 19, 30, 41, 52, 63 are objected to because of the 
following informalities: the word "send" in line 2 should be 
"sent". Appropriate correction is required. 



Claim Rejections - 35 USC §103 

3. Claims 1-66 are rejected under 35 U.S.C. 103(a) as being 
unpatentable over "Symantec System Center Implementation Guide 
(hereinafter Symantec) further in view of Chen et al (U.S. 
5, 960, 170) . 

As per claims 1, 12, 23, 34, 45, 56, Symantec discloses a 
computer program product, method, and computer comprising a 
computer program operable to control a reporting computer to 
report occurrence of an event to a receiving computer, said 
computer program comprising: report generating logic operable to 
generate report data identifying said reporting computer and 
said event (see pages 72-73) ; data retrieving logic operable to 
fetch requested data from said receiving computer to said 
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reporting computer upon a request of said reporting computer 
(see pages 13,18). 

Symantec fails to disclose report sending logic operable to 
send said report data from said reporting computer to said 
receiving computer upon fetching of said requested data. 

However, Chen et al teaches such a sending method (see 
column 7 lines 33-45) . 

At the time of the invention it would have been obvious to 
a person of ordinary skill in the art to use Chen etal's method 
of sending reports to send Symantec's generated reports. 

Motivation to do so would have been to provide iterative 
virus detection (see Chen et al column 2 lines 62-63) . 

As per claims 2, 13, 24, 35, 46, 57, the modified Symantec 
and Chen et al system discloses the event is detection of a 
computer file containing an unwanted computer program (see 
Symantec page 73 figure) . 

As per claims 3, 14, 25, 36, 47, 58, the modified Symantec 
and Chen et al system discloses the unwanted computer program is 
a computer virus (see Symantec page 73 figure) . 

As per claims 4, 15, 26, 37, 48, 59, the modified Symantec 
and Chen et al system discloses the requested data is a 
description of said event (see Symantec pages 13 and 18) . 
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As per claims 5, 16, 27, 38, 49, 60, the modified Symantec 
and Chen et al system discloses the event is detection of a 
computer file containing a computer virus (see Symantec page 73) 
and the requested data is a description of the computer virus 
(see Symantec page 18) . 

As per claims 6, 17, 28, 39, 50, 61, the modified Symantec 
and Chen et al system discloses the event is detection of a 
computer file containing a computer virus (see Symantec page 
73) ; and said requested data is an updated set of computer virus 
detecting data for use in detecting computer viruses (see 
Symantec page 18) . 

As per claims 7, 18, 29, 40, 51, 62, the modified Symantec 
and Chen et al system discloses the data retrieving logic and 
said report sending logic use an internet URL to specify said 
requested data to said receiving computer, said internet URL 
also containing said report data to be sent to said receiving 
computer (see Chen et al column 6 lines 49-57 and Symantec page 
18) . 

As per claims 8, 19, 30, 41, 52, 63, the modified Symantec 
and Chen et al system discloses said reporting computer collates 
report data specifying one or more events that is sent together 
from said reporting computer to said receiving computer after 
fetching of said requested data (see Symantec page 73 figure) . 
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As per claims 10, 21, 32, 43, 54, 65, the modified Symantec 
and Chen et al system discloses said reporting computer and said 
receiving computer communicate via an internet link (see Chen et 
al column 5 lines 3 9-57) . 

As per claims 11, 22, 33, 44, 55, 66, the modified Symantec 
and Chen et al system discloses said reporting data includes one 
or more of: a MAC address identifying a network card of said 
reporting computer; a date of said event; a time of said event; 
an identifier of a computer program used by said reporting 
computer to detect said event; an identifier of a version of a 
computer program used by said reporting computer to detect said 
event; an identifier of a set of event detecting data used by a 
computer program used by said reporting computer to detect said 
event; an identifier of an event type detected by said reporting 
computer; an action taken by said reporting computer upon 
detection of said event; and a checksum of a file that triggered 
said event (see Symantec page 73) . 

4. Claims 9, 20, 31, 42, 53, 64 are rejected under 35 
U.S.C. 103(a) as being unpatentable over the modified Symantec 
and Chen et al system as applied to claims 1, 12, 23, 34, 45, 56 
above, and further in view of Menezes et al ("Handbook of 
Applied Cryptography" ) . 
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As per claims 9, 20, 31, 42, 53, 64, the modified Symantec 
and Chen et al system fails to disclose the report data is 
encrypted by said reporting computer and decrypted by said 
receiving computer. 

However, Menezes et al discloses encrypting of data (see 
pages 15-16) . 

At the time of the invention it would have been obvious to 
a person of ordinary skill in the art to use Menezes et al's 
method of encryption to encrypt the report data of the modified 
Symantec and Chen et al system. 

Motivation to do so would have been achieve confidentiality 
(see Menezes et al page 12) . 

Conclusion 

Any inquiry concerning this communication or earlier 
communications from the examiner should be directed to Michael 
Pyzocha whose telephone number is (571) 272-3875. The examiner 
can normally be reached on 7:00am - 4:30pm first Fridays of the 
bi-week off. 

If attempts to reach the examiner by telephone are 
unsuccessful, the examiner's supervisor, Andrew Caldwell can be 
reached on (571) 272-3868. The fax phone number for the 
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organization where this application or proceeding is assigned is 
703-872-9306. 

Information regarding the status of an application may be 
obtained from the Patent Application Information Retrieval 
(PAIR) system. Status information for published applications 
may be obtained from either Private PAIR or Public PAIR. Status 
information for unpublished applications is available through 
Private PAIR only. For more information about the PAIR system, 
see http://pair-direct.uspto.gov. Should you have questions on 
access to the Private PAIR system, contact the Electronic 
Business Center (EBC) at 866-217-9197 (toll-free) . 



MJP 




